feat(logout): improve logout flow

frontend/src/lib/api/csrf.ts

@@ -17,3 +17,20 @@ export function getCsrfHeaders(): Record<string, string> {
 	const token = getCsrfToken();
 	return token ? { 'X-CSRF-Token': token } : {};
 }
+
+/**
+ * Best-effort "does the browser think it has a session?" hint. The server
+ * sets `oxicloud_csrf` (non-HttpOnly, JS-visible) alongside the session
+ * cookies on every login and clears it on logout, so its ABSENCE is a
+ * reliable proof of "no session" — cheaper than a network probe that
+ * would 401 → refresh 401 → 401 on first landing with no cookies.
+ *
+ * Its PRESENCE is only a hint: the session cookies (HttpOnly) may have
+ * been revoked server-side while the CSRF cookie lingers. Callers that
+ * see `true` must still probe /api/auth/me — this helper just lets a
+ * fresh no-cookie bootstrap skip the doomed 2× /me + /refresh burst.
+ */
+export function hasSessionHint(): boolean {
+	if (typeof document === 'undefined') return false;
+	return document.cookie.split('; ').some((row) => row.startsWith('oxicloud_csrf='));
+}